Dynamic Route53 records for AWS auto scaling groups with Terraform

[cxmcc]

You can attach an ELB to the ASG. Then DNS name to ELB. That's how AWS expects you to use it.

[Cpoll]

I can see why you might not want to, though. App ELBs charge by usage and can get somewhat expensive (like running another EC2 instance or two). They can also have cold-start performance issues in specific circumstances (traffic spikes).

[X-Istence]

That doesn't solve the problem of the hostname on the EC2 instance itself being the same across all instances thereby making it harder to see what logs came from what hosts.

It doesn't solve the problem of allowing you to look at logs and then quickly SSH'ing to a single machine in the ASG.

[jimsheldon]

Post author here.

We absolutely put an ELB/ALB in front of these ASGs as well. The post mentions a few use cases where unique hostnames with internal Route53 records are helpful for us.

[merlincorey]

This is a pretty sweet Terraform module that I will personally be testing out soon.

I was curious what they are using for the Lambda function, and it turns out is a framework-less Python script[0].

One thing I'm not clear on yet is if using this will imply one such lambda for every autoscaling group or not.

[0] https://github.com/meltwater/terraform-aws-asg-dns-handler/b...

[spier]

I just checked with the Jim, the author of the blog post, and module (we both work for Meltwater).

He confirmed "You only need one instance per account, we have always been fine with just one".

I will let him fill in further details here but I figured you would be interested in a short update on this.

[spier]

Great to hear! Please let us know how the testing goes!

[fatninja]

Can't this be solved by using IP addresses for hostnames? This can be a part of bootstrap script(which ASG/Launch Configuration already supports via UserData[1])

What I can't understand is -

If your logs are in ELK and metrics in prometheus/grafana - why do you need SSH access? Sounds like thats a good problem to solve

[1] - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-dat...

[jimsheldon]

Post author here.

SSH access is a last resort, but it can be necessary in certain cases. For example, if our log forwarding breaks. SSH is also just one example, it can also be helpful to curl endpoints on the host directly without hitting the ELB/ALB.

The post actually provides the user_data script we use.

[VectorLock]

I do this already but from my configuration management system on my instances, but one thing I don't have that I'd love if Route53 would help support is being able to run route53 to handle in-addr.arpa zones for my IP addresses so I can get reverse IP looking for my VPC networks without having to run my own resolver.

[mrud]

We run our reverse zones on route53. It is just a little bit cumbersome but overall works relatively well with vpc private hosted zones.

[spier]

Interesting, which configuration management system do you use?

[discobean]

I wrote and use this regularly, docker app that adds and removes instances from route53, similar to their terraform solution. Similar idea, different implementation.

https://github.com/discobean/route53-sidecar

[OJFord]

Why are ASGs 'outdated' in a world with Kubernetes?

Our nodes are in ASGs.

[jimsheldon]

Post author here.

I brought up that point since I think most developers prefer the user experience of Lambda/Kubernetes where they don't have to manage individual instances in Auto Scaling Groups. They certainly are not 'outdated' for our use cases, and especially not for those responsible for running the underlying infrastructure (when running Kubernetes nodes).

[aequitas]

I think AWS not having automatic hostnames for ASG instances is a way to lure you into Lambda's, at least that's how I got hooked.

[scarface74]

Why should an instance created by an ASG have a host name? These are cattle not pets. I use Serilog for logging with an EC2 enricher that automatically adds the instance Id and the IP address.

Since Serilog does structured logging, I can use either an ElasticSearch or Mongo sink and do complex queries.

If I routinely need to log into an instance to troubleshoot, I need to be capturing data and sending it to a central logging system.

[peterwwillis]

Or a way to get you more familiar with tagging, or the various queries and filters on different api results. It's annoying at first, but it leads to less reliance on the console and more effective scripting. (Instead of naming my instances I just made a script which looks up the instance I want and outputs the IP and username, and put that in an SSH config)

[jedberg]

They expect you to front it with a load balancer.